IP Address
IPv4
194.176.97.126
Aggregated from public BGP, CT logs, our scan layer, honeypots and global probes.
Run a live full scan of 194.176.97.126
On-demand: ports, banners, TLS, tech-stack, subdomains and origin/IP-leak detection. Results are shared publicly for everyone to link to.
Autonomous System
ASN
AS Name
UkrNet Fastiv
AS Type
—
RIR
RIPE NCC
Allocated
2006-07-19
Allocation status
Assigned
Geolocation
Reverse DNS
PTR
—
Last seen
—
Network
Prefix
RPKI
—
Open Ports
| Port | Proto | Service | Server | Last seen |
|---|---|---|---|---|
| 80 | tcp | http | Apache/2.2.17 (FreeBSD) mod_ssl/2.2.17 OpenSSL/0.9.8q PHP/5.3.5 with Suhosin-Patch | 2026-05-26 02:57:11.000 |
TLS Certificates
TLS certificate observations pending
Once our scan layer captures a TLS cert from this IP, certificate chain, JARM and JA4S fingerprints will appear here.
Known Vulnerabilities
Published CVEs matched to the software versions fingerprinted on this host. Matching is by product and version against the NVD dictionary — presence of a CVE does not confirm the host is exploitable (patches or backports may apply).
| CVE | Software | CVSS | Severity | Summary |
|---|---|---|---|---|
| CVE-2011-3268 | PHP 5.3.5 | 10.0 | HIGH | Buffer overflow in the crypt function in PHP before 5.3.7 allows context-dependent attackers to have an unspecified impact via a long salt argument, a different... |
| CVE-2012-2376 | PHP 5.3.5 | 10.0 | HIGH | Buffer overflow in the com_print_typeinfo function in PHP 5.4.3 and earlier on Windows allows remote attackers to execute arbitrary code via crafted arguments t... |
| CVE-2012-2688 | PHP 5.3.5 | 10.0 | HIGH | Unspecified vulnerability in the _php_stream_scandir function in the stream implementation in PHP before 5.3.15 and 5.4.x before 5.4.5 has unknown impact and re... |
| CVE-2017-3169 | Apache 2.2.17 | 9.8 | N/A | In Apache httpd 2.2.x before 2.2.33 and 2.4.x before 2.4.26, mod_ssl may dereference a NULL pointer when third-party modules call ap_hook_process_connection() d... |
| CVE-2011-4109 | OpenSSL 0.9.8q | 9.3 | HIGH | Double free vulnerability in OpenSSL 0.9.8 before 0.9.8s, when X509_V_FLAG_POLICY_CHECK is enabled, allows remote attackers to have an unspecified impact by tri... |
| CVE-2012-2110 | OpenSSL 0.9.8q | 7.5 | HIGH | The asn1_d2i_read_bio function in crypto/asn1/a_d2i_fp.c in OpenSSL before 0.9.8v, 1.0.0 before 1.0.0i, and 1.0.1 before 1.0.1a does not properly interpret inte... |
| CVE-2011-1148 | PHP 5.3.5 | 7.5 | HIGH | Use-after-free vulnerability in the substr_replace function in PHP 5.3.6 and earlier allows context-dependent attackers to cause a denial of service (memory cor... |
| CVE-2011-1938 | PHP 5.3.5 | 7.5 | HIGH | Stack-based buffer overflow in the socket_connect function in ext/sockets/sockets.c in PHP 5.3.3 through 5.3.6 might allow context-dependent attackers to execut... |
| CVE-2012-2311 | PHP 5.3.5 | 7.5 | HIGH | sapi/cgi/cgi_main.c in PHP before 5.3.13 and 5.4.x before 5.4.3, when configured as a CGI script (aka php-cgi), does not properly handle query strings that cont... |
| CVE-2013-1635 | PHP 5.3.5 | 7.5 | HIGH | ext/soap/soap.c in PHP before 5.3.22 and 5.4.x before 5.4.13 does not validate the relationship between the soap.wsdl_cache_dir directive and the open_basedir d... |
| CVE-2013-6420 | PHP 5.3.5 | 7.5 | HIGH | The asn1_time_to_time_t function in ext/openssl/openssl.c in PHP before 5.3.28, 5.4.x before 5.4.23, and 5.5.x before 5.5.7 does not properly parse (1) notBefor... |
| CVE-2014-9427 | PHP 5.3.5 | 7.5 | HIGH | sapi/cgi/cgi_main.c in the CGI component in PHP through 5.4.36, 5.5.x through 5.5.20, and 5.6.x through 5.6.4, when mmap is used to read a .php file, does not p... |
| CVE-2016-7478 | PHP 5.3.5 | 7.5 | N/A | Zend/zend_exceptions.c in PHP, possibly 5.x before 5.6.28 and 7.x before 7.0.13, allows remote attackers to cause a denial of service (infinite loop) via a craf... |
| CVE-2012-2333 | OpenSSL 0.9.8q | 6.8 | MEDIUM | Integer underflow in OpenSSL before 0.9.8x, 1.0.0 before 1.0.0j, and 1.0.1 before 1.0.1c, when TLS 1.1, TLS 1.2, or DTLS is used with CBC encryption, allows rem... |
| CVE-2011-4718 | PHP 5.3.5 | 6.8 | MEDIUM | Session fixation vulnerability in the Sessions subsystem in PHP before 5.5.2 allows remote attackers to hijack web sessions by specifying a session ID. |
| CVE-2011-2202 | PHP 5.3.5 | 6.4 | MEDIUM | The rfc1867_post_handler function in main/rfc1867.c in PHP before 5.3.7 does not properly restrict filenames in multipart/form-data POST requests, which allows... |
| CVE-2012-0057 | PHP 5.3.5 | 6.4 | MEDIUM | PHP before 5.3.9 has improper libxslt security settings, which allows remote attackers to create arbitrary files via a crafted XSLT stylesheet that uses the lib... |
| CVE-2011-0441 | PHP 5.3.5 | 6.3 | MEDIUM | The Debian GNU/Linux /etc/cron.d/php5 cron job for PHP 5.3.5 allows local users to delete arbitrary files via a symlink attack on a directory under /var/lib/php... |
| CVE-2016-4975 | Apache 2.2.17 | 6.1 | N/A | Possible CRLF injection allowing HTTP response splitting attacks for sites which use mod_userdir. This issue was mitigated by changes made in 2.4.25 and 2.2.32... |
| CVE-2012-1172 | PHP 5.3.5 | 5.8 | MEDIUM | The file-upload implementation in rfc1867.c in PHP before 5.4.0 does not properly handle invalid [ (open square bracket) characters in name values, which makes... |
| CVE-2017-3735 | OpenSSL 0.9.8q | 5.3 | N/A | While parsing an IPAddressFamily extension in an X.509 certificate, it is possible to do a one-byte overread. This would result in an incorrect text display of... |
| CVE-2012-4557 | Apache 2.2.17 | 5.0 | MEDIUM | The mod_proxy_ajp module in the Apache HTTP Server 2.2.12 through 2.2.21 places a worker node into an error state upon detection of a long request-processing ti... |
| CVE-2013-5704 | Apache 2.2.17 | 5.0 | MEDIUM | The mod_headers module in the Apache HTTP Server 2.2.22 allows remote attackers to bypass "RequestHeader unset" directives by placing a header in the trailer po... |
| CVE-2006-7250 | OpenSSL 0.9.8q | 5.0 | MEDIUM | The mime_hdr_cmp function in crypto/asn1/asn_mime.c in OpenSSL 0.9.8t and earlier allows remote attackers to cause a denial of service (NULL pointer dereference... |
| CVE-2011-0014 | OpenSSL 0.9.8q | 5.0 | MEDIUM | ssl/t1_lib.c in OpenSSL 0.9.8h through 0.9.8q and 1.0.0 through 1.0.0c allows remote attackers to cause a denial of service (crash), and possibly obtain sensiti... |
| CVE-2011-3210 | OpenSSL 0.9.8q | 5.0 | MEDIUM | The ephemeral ECDH ciphersuite functionality in OpenSSL 0.9.8 through 0.9.8r and 1.0.x before 1.0.0e does not ensure thread safety during processing of handshak... |
| CVE-2011-4576 | OpenSSL 0.9.8q | 5.0 | MEDIUM | The SSL 3.0 implementation in OpenSSL before 0.9.8s and 1.x before 1.0.0f does not properly initialize data structures for block cipher padding, which might all... |
| CVE-2011-4619 | OpenSSL 0.9.8q | 5.0 | MEDIUM | The Server Gated Cryptography (SGC) implementation in OpenSSL before 0.9.8s and 1.x before 1.0.0f does not properly handle handshake restarts, which allows remo... |
| CVE-2012-0027 | OpenSSL 0.9.8q | 5.0 | MEDIUM | The GOST ENGINE in OpenSSL before 1.0.0f does not properly handle invalid parameters for the GOST block cipher, which allows remote attackers to cause a denial... |
| CVE-2012-0884 | OpenSSL 0.9.8q | 5.0 | MEDIUM | The implementation of Cryptographic Message Syntax (CMS) and PKCS #7 in OpenSSL before 0.9.8u and 1.x before 1.0.0h does not properly restrict certain oracle be... |
| CVE-2012-1165 | OpenSSL 0.9.8q | 5.0 | MEDIUM | The mime_param_cmp function in crypto/asn1/asn_mime.c in OpenSSL before 0.9.8u and 1.x before 1.0.0h allows remote attackers to cause a denial of service (NULL... |
| CVE-2013-0166 | OpenSSL 0.9.8q | 5.0 | MEDIUM | OpenSSL before 0.9.8y, 1.0.0 before 1.0.0k, and 1.0.1 before 1.0.1d does not properly perform signature verification for OCSP responses, which allows remote OCS... |
| CVE-2014-3505 | OpenSSL 0.9.8q | 5.0 | MEDIUM | Double free vulnerability in d1_both.c in the DTLS implementation in OpenSSL 0.9.8 before 0.9.8zb, 1.0.0 before 1.0.0n, and 1.0.1 before 1.0.1i allows remote at... |
| CVE-2014-3506 | OpenSSL 0.9.8q | 5.0 | MEDIUM | d1_both.c in the DTLS implementation in OpenSSL 0.9.8 before 0.9.8zb, 1.0.0 before 1.0.0n, and 1.0.1 before 1.0.1i allows remote attackers to cause a denial of... |
| CVE-2014-3507 | OpenSSL 0.9.8q | 5.0 | MEDIUM | Memory leak in d1_both.c in the DTLS implementation in OpenSSL 0.9.8 before 0.9.8zb, 1.0.0 before 1.0.0n, and 1.0.1 before 1.0.1i allows remote attackers to cau... |
| CVE-2011-0420 | PHP 5.3.5 | 5.0 | MEDIUM | The grapheme_extract function in the Internationalization extension (Intl) for ICU for PHP 5.3.5 allows context-dependent attackers to cause a denial of service... |
| CVE-2011-3182 | PHP 5.3.5 | 5.0 | MEDIUM | PHP before 5.3.7 does not properly check the return values of the malloc, calloc, and realloc library functions, which allows context-dependent attackers to cau... |
| CVE-2011-3267 | PHP 5.3.5 | 5.0 | MEDIUM | PHP before 5.3.7 does not properly implement the error_log function, which allows context-dependent attackers to cause a denial of service (application crash) v... |
| CVE-2011-4885 | PHP 5.3.5 | 5.0 | MEDIUM | PHP before 5.3.9 computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers... |
| CVE-2012-0788 | PHP 5.3.5 | 5.0 | MEDIUM | The PDORow implementation in PHP before 5.3.9 does not properly interact with the session feature, which allows remote attackers to cause a denial of service (a... |
Tech Stack
Wappalyzer fingerprinting pending
HTTP-body analysis identifies web frameworks, CMS platforms, analytics, JS libraries and server-side languages from this host.
Origin / IP-Leak
USP
When a hostname is served behind a CDN (e.g. Cloudflare), the origin server can sometimes be identified by matching its TLS cert against the protected hostname. Findings shown here are heuristic candidates, not guarantees.
No origin-leak candidates for this IP
When this IP serves a TLS cert for a domain that fronts behind a CDN, that domain surfaces here as an origin-leak candidate with a confidence score.
Multi-Vantage Check
Reachability accrued passively from real user-triggered checks across our 65+ probe nodes. Run a live check to add fresh data.
ICMP responsive
This IP replied to our global ICMP sweep — last confirmed 2026-08-01.
No accumulated reachability data yet
Reachability accrues from real user-triggered checks. Trigger a Ping or HTTP check from our 65+ probe nodes to contribute the first data point.
Threat Intelligence
No threat-intel matches
This IP doesn't appear in any of the feeds we mirror (Tor exits, FireHOL Level 1-3, Spamhaus DROP/EDROP, URLhaus, OpenPhish). Absence here doesn't prove the IP is clean — it just means none of our public-feed sources flag it.
Co-Hosted Domains
No DNS-confirmed domains yet
We cross-reference body-cited domains against our DNS resolver records. Confirmations appear here once both sides have data for the same name.
External References
No external references found yet
As HTML bodies get banner-grabbed, references to external domains land here.
History
First observed
2026-05-26 02:57
Last observed
2026-05-26 02:57
Scan observations
2
The full change-log (ASN moves, cert rotations, port-state diffs) accumulates as our archives grow.